Technical documentation
MATCHA Writer is a local-first desktop application. When used unlicensed (free edition) outside of a course context, it does not share any information with us, MATCHA Technologies Ltd., or anyone else. This is the starting point for privacy and security in MATCHA: no shared information .
The rest of this page explains when and how MATCHA departs from this starting point. For more general information about how we collect and use information throughout our business, including the portal tools available to instructors and administrators, see our general Privacy Policy .
When a student is writing in MATCHA for a course activity, we need to keep track of some activity metadata to enforce academic integrity constraints. However, MATCHA is able to operate with very little information sharing. The level of information sharing can be controlled by setting the Privacy Level setting at the organization level or course level. Organization-level settings constrain course settings, which constrain activity settings. The following privacy levels are available:
MATCHA Writer may share students' personally identifiable information as well as students' work histories with MATCHA and subprocessors (depending on the activity features used). See Data Sharing by Activity Features for more information. As described below, information shared is clearly stated to students as part of a pre-activity information collection disclosure.
MATCHA Writer encrypts all personally identifiable information .
A notch more private than Level 2, this mode prevents any student personal information from being shared.
The ultimate privacy-protecting mode, this mode is designed so you and your students don't have to trust MATCHA services or your installed copy of MATCHA Writer with more information than is strictly necessary for MATCHA to do its basic job.
Importantly, usage of individual licenses and technical support imply exceptions to these data sharing rules, as described below. Beyond Zero Trust, another option is to not use instructor-managed activities. An instructor can ask her students to create independent MATCHA projects with certain settings (including Complete Work History). The produced .mcha or .docx files can be uploaded to the LMS, and the instructor can verify that the required settings were in place. In this local mode, Writer does not even share control data with us.
When licensed by an individual, MATCHA Writer shares basic billing and account information with us and our payment processor, Stripe, which handles sensitive payment information.
Note for teaching institutions: Students do not need to have individual licenses to use MATCHA for their courses unless your institution has selected the student pay licensing model .
Cloud Sync and Live Collaboration are features that store a document's primary copy in MATCHA Cloud so it can be synchronized across devices or shared with collaborators. When enabled, MATCHA may collect:
Note for teaching institutions: These features can be and usually are disabled for course activities as part of our global security controls, discussed above.
Making a technical support request requires sharing personal identifiable information (minimally, name and email). This allows us to get back to you about the problem. In addition, we suggest attaching your project file if relevant. Project files contain your editing and browsing history for the project.
MATCHA clearly discloses the information it collects. Because collection depends on the features enabled for an activity, MATCHA uses two layers of disclosure: a general disclosure in its End User License Agreement and a specific activity disclosure shown before a student starts an instructor-led activity.
The activity-specific disclosure appears in the Activity Summary and emphasizes the information collected for that activity's actual configuration.
Just to be sure, we also show this reminder whenever a users starts a new browsing session and Complete Work History (browsing recording) is enabled:
MATCHA is designed and operated to support GDPR-compliant deployments. In institution-configured courses and activities, MATCHA commonly acts as a processor or service provider while the institution determines the educational purpose, legal basis, notices, retention, and downstream use of records. For MATCHA-controlled services such as the public website, account administration, billing, security monitoring, and support, MATCHA may act as controller.
MATCHA supports privacy requests, deletion requests, access requests, and institution-directed request handling subject to contractual, legal, security, backup, and institutional limits. Questions or privacy requests may be sent to our Data Privacy Officer at dpo@matchatech.io .
In addition to the four privacy levels described above, organizations can also configure the following privacy and security settings.
Accounts and organizations can be created within one of three geographically isolated MATCHA platforms. Each platform uses separate data-bearing services and storage resources for accounts, organizations, activities, submissions, and documents.
We offer additional residency options for student submissions (uploaded .docx or .mcha files) on our optional MATCHA Cloud service.
Submissions for FedRAMP and EU-hosted organizations automatically locate within FedRAMP and EU storage buckets. Global-hosted organizations currently have the choice of any of the following locations:
Organizations can configure a course data retention period from 1 to 36 months. The default is 12 months. Courses, activities, submissions, and associated proctoring data are deleted after the course end date plus the configured retention period.
Once data is deleted from active systems, deletion propagates to backup systems as backups rotate. MATCHA's backup retention period is currently 180 days.
If you have any questions about MATCHA and data privacy or security, please get in touch with our Data Privacy Officer at dpo@matchatech.io.
We have a HECVAT package with additional documentation for institutional review. Contact dpo@matchatech.io to obtain a copy.
